Alert Setup

[sayashagarwal27]

Alert should trigger each time if count of event is less 10 in last 30 min. But it will aggregate alerts if count is more than 10 in last 30 min

[richgalloway]

So if two events occur every 30 minutes then you want two alerts triggered and if 11 events occur then you want a single alert, correct?  If so then Splunk does not throttle alerts that way.  Go to https://ideas.splunk.com to suggest Splunk offer it.

If that is not what you seek then please describe the problem more.